Click here to Skip to main content
15,895,370 members
Home / Discussions / System Admin
   

System Admin

 
GeneralRe: e-mail Pin
toxcct25-May-05 1:47
toxcct25-May-05 1:47 
GeneralRe: e-mail Pin
MoustafaS25-May-05 3:15
MoustafaS25-May-05 3:15 
GeneralRe: e-mail Pin
toxcct25-May-05 3:18
toxcct25-May-05 3:18 
GeneralRe: e-mail Pin
MoustafaS25-May-05 3:32
MoustafaS25-May-05 3:32 
GeneralRe: e-mail Pin
albCode6-Jun-05 2:51
albCode6-Jun-05 2:51 
GeneralRe: e-mail Pin
Vasudevan Deepak Kumar11-Jun-05 3:13
Vasudevan Deepak Kumar11-Jun-05 3:13 
GeneralRecovering deleted EFS-encrypted file Pin
Levente Farkas23-May-05 20:43
Levente Farkas23-May-05 20:43 
GeneralRe: Recovering deleted EFS-encrypted file Pin
Levente Farkas2-Jun-05 1:15
Levente Farkas2-Jun-05 1:15 
While struggling to solve this problem I found another approach. This leaves me with two possible solutions, unfortunately both are crippled by the lack of information:

1. Either I read and parse the file's LOGGED_UTILITY_STREAM NTFS attribute (named $EFS), then I recover the encrtypted FEK from there (and then decrypt the FEK, etc.). The problem here is that even if in "Inside Windows 2000" the general structure of the $EFS attribute is described, I cannnot find precise documentation (a structure definition would be good!) for it (e.g. some fields may be missing and so on). After looking at hundreds of encrypted files, I still cannot empirically deduce this structure.

2. Either I use the WriteEncryptedFileRaw API and then I feed it with the necessary data in the callback function, essentially attempting a restore directly from the deleted file. Again, I see by attempting to use ReadEncryptedFileRaw that the data this API stuffs into my callback function on backup is some header, followed by the $EFS attribute (slightly modified!), then some addional data, probably another header, then the encryped content, interrupted every now and then by some unknown data. I have no documentation for any of these.

Anyone could give me a hand here, guys?

Levente

------------------------------------------->>
Life is tough. Then die you do. [Yoda]
Generallimited Pin
Omar _23-May-05 7:20
Omar _23-May-05 7:20 
GeneralRe: limited Pin
toxcct23-May-05 21:31
toxcct23-May-05 21:31 
GeneralRe: limited Pin
ThatsAlok24-May-05 21:02
ThatsAlok24-May-05 21:02 
Generalexecutable files Pin
_tasleem22-May-05 20:27
_tasleem22-May-05 20:27 
GeneralRe: executable files Pin
Mekong River7-Jun-05 5:38
Mekong River7-Jun-05 5:38 
GeneralPostfix relaying mail question... Pin
Phil.Benson20-May-05 4:06
professionalPhil.Benson20-May-05 4:06 
QuestionHow to track the client..... Pin
Member 184298619-May-05 20:40
Member 184298619-May-05 20:40 
Generalsystem processes Pin
anuraga0218-May-05 18:08
anuraga0218-May-05 18:08 
GeneralRe: system processes Pin
Alexander German25-May-05 0:23
Alexander German25-May-05 0:23 
GeneralWildcard email addresses in exchange 2000 Pin
Malcolm Smart18-May-05 10:31
Malcolm Smart18-May-05 10:31 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Ryan McCauley21-May-05 13:08
Ryan McCauley21-May-05 13:08 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
NeverHeardOfMe22-May-05 21:32
NeverHeardOfMe22-May-05 21:32 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Levente Farkas23-May-05 20:50
Levente Farkas23-May-05 20:50 
GeneralRe: Wildcard email addresses in exchange 2000 Pin
Malcolm Smart24-May-05 20:34
Malcolm Smart24-May-05 20:34 
GeneralDisable print screen feature Windows 2000 Pin
JON1088414-May-05 11:05
JON1088414-May-05 11:05 
GeneralRe: Disable print screen feature Windows 2000 Pin
Mekong River14-May-05 19:59
Mekong River14-May-05 19:59 
GeneralRe: Disable print screen feature Windows 2000 Pin
K Baruah16-May-05 2:16
K Baruah16-May-05 2:16 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.